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(54) FIREWALL SYSTEM 

(57)Abstract: 

PROBLEM TO BE SOLVED: To provide a packet filtering 
type firewall system which is easily operated. 
SOLUTION: Each firewall device 102 performs packet 
filtering according to prescribed filtering rules, further 
monitors a packet which can be passed by the present 
filtering rules and, when the packet is judged to be 
refused, extracts a transmitting origin IP address from 
the header part of the packet and updates the filtering 
rules on the basis of extracted information. Furthermore, 
the transmitting origin IP address, etc., are recorded and 
periodically transmitted to a maintenance center server 
101. The server 101 periodically processes the 
information transmitted from each device 102 
statistically and transmits a refused IP address, etc., 
which is judged to be shared by a plurality of the devices 
102 to each device 102. Each device 102 updates the 
filtering rules of itself, etc., on the basis of the 
information transmitted from the server 101. 
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(Partial Translation) JP 2003-273936 A 
[0002] 

[Conventional Art] Conventionally, as a technology for 
5 ensuring network security, a firewall has been known. The 
firewall is placed between an external network such as 
Internet and an internal network such as an in-enterprise 
LAN and is a technique for blocking such as an intrusion 
from the external network to the internal network by 
10 controlling whether to permit communication for every data 
based on a predefined standard. 

[0003] Such a firewall has various systems, among which, 
a packet filtering type firewall system is available. The 
packet filtering type firewall system controls whether to 
15 permit passing of every packet from an external network to 
an internal network (or an internal network to an external 
network) . Such a control is performed in accordance with a 
predetermined filtering rule. 

[0004] Normally, under the filtering rule, a packet to 
20 be a filtering target is identified by a transmission 

source IP address, a destination IP address, a transmission 
source port number, a destination port number, type of 
protocol, and the like and an action (pass, rejection, 
etc.) for the packet is designated. 
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[0 0 5 4] H0(c^-rj;5t, ffijg^y^ MHSt- 
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■/Mi, rjMff^j 7^-;i/K4 o 1 1, r^j 

-;l>F4 0 2fc, lfuY^)U 7-f-;H f 4 03£, 

rgfi^Jj 7-f-;HM o 4 t£!x.T^So 

[0 0 5 5] r^TtJ 7^-7VF4 0 1 fc(4, ^y 
F©£<l7t©I P7FbX (fttf, iSgfcJ&fcTtf-h 
f^) *li?n§o r^ajfej 7-f-;bK4 0 2Ktt, 
/^7KD^5tOI P7Fb7, (Rtf, jfcHfcJSUT* 
-F#^f) AWi^ftSo r7ahn;l/j 7-r-;l/K4 
0 31:^ /^<y F©7a F3;b«gy£^TtitfS«fi 
Stt5«> rsi^jijj 7^-;l/F4 0 4(C(±, /^vh 10 

[0 0 5 6]^7 0 2«. ««Lfc^y 

F©^^£JIBMtU »^-y bW&DSLoi* 

mm<D^>ry hfrttmuzo zlx. 770^-^3 

ym<DT-f (#JAl±\ HTML77^;KDrtS) 
O/^yHc^Tli, *©T-*aB#£, TCP/ I 
p/vy^t^ W£«3 0 3K3S*o tfc, 
;Hc Hill" S/^r-y htoVTH, ^©^-./Wy^ 
WlfflU TCP/ I P'vy^fcftfc, W£«3 0 4K3S 
i,„ *-btWLT7^-fe^*ffo^^-y hto 20 
^T«, TCP/I P'\y#Sffi£»3 0 5fc3&Sa & 
WS8IS3 0 3-3 0 5«, ><frv USfflffi3 0 2fr£>ai 

/^r>y FT'&Sfr5fr£ffl£-f S<= 
[0 0 5 7] *IC, hWBBtlZW 

7 h-pftsjws^ws-rsfij^wa 0 3-3 0 5 to 

3 0 3-3 0 5jW8tf&ftTl/V6« 
[0 0 5 8] $1% ¥'J^g|3 3 0 3fC-^TlEWS 0 
[0 0 5 9] ¥lj^3l53 0 3tt, ^-y Hc$3;tlS77 30 
'jy-yaylM/l/Of-^lC ^i&lSSSftfci? 
W^ftT^SfrgfrlcJ^T, S^^-y hiWiS 
t^ZWv h-CSSJtPSfrfcWS-rSa *©fc** w 
£353 0 3 fi, JggT^t #?7"iJ© U 7 F (fgST^J 
U7F) *«8LT^S. 

[0 0 6 0] ilOjggjfcJWXHi, 77^77*- 
;H$Bl 0 2OSfflM^fc, ffa^fcitjTS^sn 

0 i*^w>n-F?n§„ mmmmnm^ 

i^iJUXFt-ov^ra, ?6777i'iATAA-F 40 

[0 0 6 1] Sfc, ffiSX^MU^hEtt, £7777 
>7*-;l/SBl 0 2£»ALfc-!MF«fc:, fi«« 

S#?W*Hi, jaHWfc 3Bfc-@) , 

mmmtmc 9--^- 1 0 1 tajsn 

So Mfc, JiSi¥?iJ'J7Ftt, ArJU^f, S7r^ 
77*- mm. 1 0 2 OBfft- K«*tfSSE2ftfc» 
flSOflllBkftK, ^- 101K 50 
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S^tlSo 

[ 0 0 6 2] 0 5 a, wsap 303 jowsjaaoifin* 

^1-7P-^-^-FTfe?> 0 

[0 0 6 3] HHfc^tJ:5t, W£gP3 0 3t£, S 
1\ /VJry F$»3 0 2fr?>M2ftSTCP/I P/< 
-y h Or- 7 £ , fgS^?5<J U X F ft ©SiS^^J^ 
Sfc-TSfrSfrSJRfc (S 5 0 I) o 

[0 0 6 4] *©!§£, JgSX^J*^SnTV&fr^ 
fci§£tt (S 5 0 l : NO) , fO$III?:^7t 

So 

[0 0 6 5] g§7J#W#3:ftTV^i§£ti 
(S50 l : YESK 3S><4ry 

I P7FbX£ttttifS (S 5 0 2) o ^ Lt, W^SP 
3 0 3ti, MiL/oMS^I P7Fb7t. 

Ftc#f nTi^cjgsx^Jt, WSSP3 0 2>*mrm 

7^;l/7'J v^;l/-;wejflg|53 o 6tciSLT 
(s 5 0 3) , jaa*«7t5o 

[0 0 6 6] 60:0*5 CUT, W£»3 0 3fcJ3tt* 

[0067] ¥OT3 0 Aic-D^rmmt^o 

[0 0 6 8] fiJSSP 3 0 4(4, JSffiUfc/^'V FtfX* 
i^-zI/tcWatS/^-y FT*&Sfr§fr£ffl5rfSo 

W£*3 0 4 ti, FJ*ffig|33 0 2*' 

So 

[ 0 0 6 9 ] m 6 14, JpJ^SIS 3 0 4 ©ffl£«Bi!©8&h* 
/ T^7n-7 1 -v-FTfeSo 

[0 0 7 0] Pat^f<t9t, ¥0^3 0 4 tt, S 
t\ /^-y FJflS2SI53 0 2fr&atSft;5TCP/I P-n 

jafcW±©^-^ • F^gftbT^S^Sfr^W 
3TTS (S6 0 1) o 

[0 0 7 1] ^©^ ^-©^fiTcfrC., m^Hrt 
K, msawi©^-^ • F^SfSLTt/^V^f 
(S 6 0 1 : NO) , ^©^S^a^HT-TSo 

[0072] -^r, i^-©as®7n*^, m^rartt, 

PJt»X±©^-;1/ • /^ry F^^fBLT^/cl^tt 
(S 6 0 1 : Y E S) , TlcgOV 

T> SIS^-;U/b%iM^-;bT$S^§A^WStS 
(S602) o ^-;i/*«^-;b-e*S^S^tt, m 

*tf, ^-;l^Ny^fc TReceivedU ff^Rlf)£i!(^±^ 
[0 0 7 3] ^©*SS, 

(S 6 0 2 : NO) , ^©^Ma^HTTSo 

[0 0 7 4] feSI^-;l/T?feS^a (S 6 0 
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2 : YE S) , MULfc/Vr? h*mm^^>rv F 
t$\l£L, ^WWvVaysy mSjt<Dl P 
7¥VXm&tZ> (S 6 0 3) o f LT, «/£g£3 0 
4«, J*mLfciSM7Cl P7FbXfc, W£g[53 0 4 £ 
3lir§ISiJ?£, 7 4 V y9Ar-Mm» 3 0 6 KM 
LT (S 6 0 4) , JttUSUTtS. 

[0 0 7 5] fi<±0J:3li:LT, W£»3 0 4fc»tS 

[0 0 7 6] 0 5tO^TKiWtS 0 

[0 0 7 7] WSSP3 0 5a, JSffiLfc/^-y htft°- 

F S^O U X h 0§g#- F U X h ) * 

«t#LTfcD> sic *>rvhmumo2frc>mk» 
?nsTCP/i p^y^*EaLT6t, R-oMfi 

[0078] a 7 a, w^gp 305 owsaiaoijitn* 

/jrOn-^-FT&So 

[0 0 7 9] H3g|fc:*f«fc a fC, ^-5r-yHfffi3|53 0 2 
fr£TCP/I P'Vy^gtf^Sfc, *iJ/gg|5305 

h-ea5**«s*»%fij£i-« (s 7 o i ) „ 
[0080] ^-Fx^+xcura-ra/^ 

7 hTftV^W^LftH^a (S 7 0 l : NO) , ^© 
[0 0 8 i]-£, #-\-z**yK.fflmtWrvb 

•e&ztWMLrzm&t (s 7 0 1 : y e s) , 

y7hCN-y»f,, B#7G©I 
S (S 7 0 2) „ *LT, TOE8B3 0 5H:, «lWtfc35 
fgTt I P7 FbXi:, fiJS33 3 0 5 *3?r8SiJ? %7 4 
)W U yMz-H/filtPS 3 0 6 fcig LT (S703) , 

[0 0 8 2] «±©J:5fcLT, TOg8B3 0 5fcfctt5 

[0 0 8 3] *PJ£SI53 0 3~3 0 5*^JgS-r^taS 

©tcI P7FbX^tfMSn*fc, 7y;I/*U>^- 
;MH»a53 0 6t±, SIuMS/cI P7FbXfrC,<D^ 
■y F£f§STt&£5fc, rt*r<y ;l/*y>?8B3 
o l u 77>-;1/£M$tT&o 

[008 4] S fe, 7 W U y ^-;MHW|S 306 
Gmryx— 9-/^-1 o l^SSfcft, #M5£» 

3 0 3~3 0 5A»6»?n«1lHB (ffiSf ^*2Hl7C I 
P 7 F 1/Xf) ^llMEIi LTfc < 0 

[0 0 8 5] *l»81fcfc^Tfi, 7-r;l/*"J >7*;l/ 
-;M&JfflgB3 o 6/fiiinf y y^v-zMco 

R£nfli"e&S. «*tf, X^U^-^tf-FX^-v 
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yto^ra, -wpftt, *©j£M7Efr£©^7-y F* 

JBStSJStfTfJEO -g©^IE77^X 

[0 0 8 6] C©£3ft#&fc#J&-e*5<J:5fc:'f5fc 
MlJ£gP3 0 3~3 0 5«t, £ 
fflSSB 3 0 3-30 5 Jggf^ £ 1 VIZ L fcJMM^ I 
P7FbXfr5©^Vy F%, -«fWfcfiSt5A\ 7* 

io assftfewsasip^^ jgsi P7Fi^§«q£n 

Sfc, S^JgSI P7FL/X{cfio*^T, 7^7<J> 
7*;l/-;l/*iIiraLfcB#SiJ*, ^BSI P7FbXfc# 

js?-&TiH»tT*t» jaws, ^i6i*J6?.nrcfifw 

©J;?fttti^i-|>£i:T\ mil, S*«fcttiHi£ 
ffi^Lfc^fljtfrc,, -BfW£X/^M-;l^- F 
X++>HA^-^fc±I^c, S&Sflrcfr £©/<*.? F 
£-fftWfcJ§§LT, Loo, 

[0 0 8 7] JSifc, 7 ^ y>ffr-)lM9ffl 306 
7 F t WlSS^TlBfii LTfc<o C(D£.olC74Jl 

*v y?ji-)i*wmLrcm&amixis< cticx 

[0 0 8 8] gftfc, 7-^SfigP3 0 7£tfr-*£ 
30 [0 0 8 9] 7- mm 3 0 7 tt, 

■fey^— 9—^-1 o l^i-rsfcftoto-pfes. 
fiWsv*^ 9--^- 1 o i -\Sft?n§ffifgt lt 
ii, 7-f /l/^Uyy;U-;WBiJ»SI53 o 6Kffi8Sft"tv 
5JESiP7Fl^x, fgs^^J, 7^;WJyy;^ 
;PiitoB#SiJSy'7 ;!/ ^ u > iJ^BfJiJ^ V, W 
^g|33 0 3ft^}f tSlg^tW; X h^, 77^77 
*-;USS l o 2 ©»ftt- FlSfli^^feSo 
[0 0 9 0] r-^SMS|33 0 8ti, 9— 
^-101 fr&amSftT< Sjgg/^-y MiW»|g 
40 (gSX^^lJRtfigS I P 7 F UX) ^Sfl L, fg§5 
??ij^|ij^g|53 0 3(CigL, fggl P7FbX^7f;l/ 

? u y?)\s-mmffl>3 o 6 (cMfo 

[00 9 1] 7 7^77*- ;l/»Bl 0 2 «, i^±©j; 

tf-z^-l 0 1 t<DmT°>jm%7 ! -$<D 3 P*)%Lt) 
[0 0 9 2] *fc, 9— /S- 1 0 1 ©Pffl 

50 fcotvcBMM-So 
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[0 0 9 3] |8(i, ®ft*.y*—V-X—\ 0 1<DA 
®&*yjt— V-A- 1 0 1S, CPU801t, ^ 

i ot, m-FtVx^sbs i i t, hy-^-r 

y*7x-X»8 0 6 fc«x5„ 
[0 0 9 4] C P U 8 0 1 , ^-fy^^'J 8 0 2, /n- 
FyVX^y^x-XgAS 1 0, *>y h7-X-f> 

^7x-xgi58 o 6«, tn^etu rtX808lcmM-£ 

tiTt^o M-F-rVXX>i'>'X7x-Xg|38 1 10 

*-y h7-7^>X7x-Xg!$8 0 6(4, ?1-g|5*-yh7 
-7 Uy*-*v M 0 4) fcSSRSft*. 
[0 0 9 5] CPU 8 0 1(4, ffi^-feyX— 1 

0 1 ffi5WMifT • Wt5*«8lT'fe 
§ 0 ^^t'j 8 0 2H, CPU 8 0 ltf;pjfflt3£ 
S7W7A*r-**l^*3±iE1ggilTfcSo m 
-F7>X?S©8 1 1 a, CPU 8 0 ltffiJfflfSO 

s * <Dm&m?u >f=y a jfr - 9 mm % mmm 

»BT*So 20 
[0 0 9 6] M-K7V77-ry£7x-7g|58 1 0 
(4, ;v-FrVX7gB8 1 1 £AZ8 0 8 t<D?$<DT 

>X7x-Xg|58 0 6(4, ftg|3*>y h7-Xi^X8 0 

[0 0 9 7] 09(4, U^-ty?— 9—^- 1 0 KDV 

[0 0 9 8] HHfc^fJ: 3 fc, fiW-ty*-*-/^- 

1 0 1 (4, r-*§MSP9 0 1 fc, 12®g|59 0 2 ft! 

tfjaagP9 0 3fc, fis/^-y MsufitfEx-x^-x 30 

9 0 4 &#r-*aif?g09 0 5 t, r-*3S<l»9 
0 6i:^Ix5 o &g|39 0 1-9 0 6(4, g*W(C, C 
PU80 1tf, ^y^U 8 0 2(cn-F£ftfc7D 

[0 0 9 9] r-*£MSP9 0 1(4, £77^77*- 

;i/sn 1 0 2*>e.a5nT<sii«%SM-r5o £77 

-Y77*-;bSBl 0 2frc.£P,ftT<i,tl$8(c(4, & 
7 7-T77*- ;bSBl 0 2 ©If£©Sjf1^e- Fltffi 

LtcWyhtcmzmgrt'r'yi'ftm o^ufvy 40 
?/i-)]<mimo6imnt&ffl8) , £77^-77 

(TO£gfl3 0 3«l) ftftStl§„ 

[0 10 0] &7 7>f 77*- ;1>SB 1 0 2fr53aS6n 
Tt«g§/^-y Mfffi(4, IHiS^9 0 2fciES^ft 
§o IB®gP9 0 2(c(i, «&<D77-f77*- ;imm\ 

§o $etsasgP9 o 3(4, iasa59 o 2 tiBS^ti^m 

3><*y MBffifcSSIWt -B-H1) ffithffi 

SLT, HS©77^77*-;HSBl 0 2T?4±WT^ 50 
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$gr-X^-X 9 0 4 (Cfgffl-f So 
[0 i o l] Hi 0(4, Jgg^y hMfffir-X^ 

-X 9 0 4 O^flS^t HTfcSo 

[0102] HHfcaVriSfc, *r-M-X9 0 4 
(4, r*rdTUj 7^-;l/F 1 0 0 1 t, Pr-*«j 
7f-;I/Fl 002 t, Tr-XJ 7^-;bFl 003 
fc, rjMHJ 7^-;VKl 004tmSo 
[0 10 3] Tijf ^UJ 7^-^F 1 0 0 1 (c(4, A 
rJ'J £!§iJt£I$B>J? (fl&JAfcf, 0000-9999 

[0 10 4] Tx-Xfflj 7^-;l/Fl 0 0 2t(4, 
T7-XJ 1 0 0 3fcft#lSftTV>5T-* 

?5>JJ "P*4*\ Tfggl P7FUXJ 

[0 10 5] T7-XJ 7^-;l/F 1 0 0 3tc(4, \f 
-tm 7f-;l/Fl 0 0 2fc*3ftfcr-*©iglfc 
tttSLT, }gSX?5iJXttlgS I P7KbX«2ti 
3 0 

[0106] rugij 7-r-;i/F i oo 4(c(4, i"r- 

XJ 7-r-;VKKlfttt£ftTV3I P7KUXtf, 
ftSHHT'Jgg-r^t I P7Fl^X££ftTt/^©;fr£ 

t wmt s 1 © fc l rtsst ^ § fc s ftx v ^ © *\ 
r#-hx*+>j (cwa-rstotLTjist^f t 

? ft T ^ 5 03A^?r^T'B«A^ffi 5 ft 5» 
[ 0 I 0 7] amr-23!8?aS9 0 5(4, r*r^Uj 

7^r-;i/F looit rgaj 7-f-zi/K ioo4^f 

oT, &77^77*-;l/gBl 0 2^e>JMe>ftTtfc 

^LT, ^S(C)SUT, M*fflb/c»^-y MK8IJ1S 
fgi:, ^77^77*-;l/gfil 0 2^?,iM?,ftTt/c 

fftfc^, ^7 7^77*- Mimi 0 2m 
LTV^^S/^-y Mi&J'IffS^SJRLT, 7-XjM 
<tg|59 0 6^^ 
[0 10 8] r-*3HiSP9 0 6(4, ^if-^IjR^ 
9 0 5ft^ffl[*nfcJgS^^'y MKS'JIfffi*, r-XS 
#g|?9 0 1 jb^SSnsSSMTcl^i! GMflTC I P 7 F U 
X^) 4-0, v h'Bfg^^JMoTt 

rc77-r77*-;l/SB 1 0 2-^&®t5o 
[0 10 9] ftfc, fiW-fey*— 9— ^- 1 0 1 (4, £ 
S/^vbMSJ««r-^-X9 0 4O rr-Xj 7 
-r — ;U K 1 0 0 3fc-&£ftTV>£ I P7FbX^-T§ 

T, gEft (#4) LTi^^i:W»r^ftfctI^(4, J§§ 
/^>y H^BiJ1fffi7-X^-X9 0 4fre>mg.mm& 
JgS/^-y h»tt$87-X^-X9 0 4©^^> 
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[01 10] u^-tyf— 9— 1 o i a, «±o± 

SftflljSfcWLIVSOT?, &7 7^77*-;l/§i«l 

o 2 fcoH^jessar-^o^ C t^Bj 

[0 111] 

[01] *I»J;?>77^77*-;^>XtA0£ 
[02] 77^77*-;HS«l 0 2On-F^i7 
[03] 77^77*- ;l/£E»l 0 2<077b7x7 
[04] Jfffl^'v MBST-^KOttfiEffJ^^-rK 

[0 5 ] 303 ©!pj£fiyioatn*s-r 7n- 

[06] ¥0^3 0 4 O¥lJ£®S0^n^^t-7n- 
[0 7] ¥ij£gfl3 0 5 OW£fflI<DflEh%a?t70- 
[08] l 0 1 <0a-K")i7 

[09] ft^-tr^*— 9—^-1 0 l<D77b7x7 
[0 1 0] JBS'^v 0 4 
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= 101 ft^-fey*— 9— 

102a~102c 77'f77*-;bSB 

103a~103c 

104 

105a~105c rtSP**yh7-? 

2 0 1 CPU 

2 0 2 ^^>^t'J 

2 0 3 ROM 

2 0 4 PC*-K^>^7x-7.gP 

2 0 5 >"J7;i-ry£7x-7.gp 

2 0 6, 2 0 7 *<y b7-7^>£7x-XgP 
2 0 8 A7 

2 0 9 77'7'>aATA*-H 
30 1 rtyyh7<fA>*Vy9to 

3 0 2 /^-yUfffiaS 
3 0 3-3 0 5 lO^gP 

306 7 w u y 9h-mw& 

307 r-^Mf^ 

308 r-zmm 

8 0 1 CPU 

8 0 2 ^-Yy^^-U 

80 6 *y h7-^>#7x-Xg|5 

80 8 ^X 

810 /N-KfVX^>#7x-Xg|5 

8 1 1 A-Kf^X^gl 
90 1 r-^gfggP 

9 0 2 idSgp 

9 0 3 ffifH&SfflJ 

9 0 4 WSWv Ymfiffif-?*-* 

9 0 5 £<i7'-5«^ 

906 r-zmim 
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